Erich Blume
d03ed337a9
Weekly non-local-container task: localize the Tailscale operator stack on **both clusters**. ## What - **`containers/tailscale-operator/`** (new) — builds `cmd/k8s-operator` v1.94.2 from the forge mirror, mirroring upstream's mkctr recipe (`/usr/local/bin/operator`, `ts_kube,ts_package_container` go tags, version stamps). `container.py` (dagger) for indri/arm64; `default.nix` for ringtail/amd64. - **`containers/tailscale/container.py`** (new) — dagger/arm64 build of the proxy image (containerboot), mirroring the upstream Dockerfile (iptables-legacy symlinks, `/tailscale/run.sh` compat). Ringtail already consumes the existing nix build; this completes parity for indri. - **Version pinned at v1.94.2** (same as currently deployed) — this PR is a pure supply-chain swap, no version change. v1.96.x is avoided deliberately (MagicDNS-in-containers regression). - Docs-first: tailscale-operator card gains **Local Images** and **Rollout Safety** sections. ## Rollout plan (after image builds) 1. Manifest commit: per-overlay `images:` override for the operator + ProxyClass strategic-merge patch on indri (kustomize `images:` can't touch CR fields). 2. `argocd app set tailscale-operator --revision <branch> && argocd app sync` — indri first, verify, then ringtail. 3. **Shadow-device safety**: device identity lives in the tailscale state Secrets; an image swap re-uses existing node keys, so no `-1` clones. State Secrets are not touched. Post-sync verification: pod health, device names unchanged, `mise run services-check`. ## Follow-ups (not this PR) - `dnsconfig` nameserver image (`tailscale/k8s-nameserver:stable`) still upstream. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: #374
53 lines
1.6 KiB
Python
53 lines
1.6 KiB
Python
"""Tailscale Kubernetes operator — native Dagger build.
|
|
|
|
Single Go binary (cmd/k8s-operator) from the forge mirror, mirroring
|
|
upstream's build_docker.sh mkctr recipe: binary at /usr/local/bin/operator,
|
|
go tags ts_kube + ts_package_container, version stamps in ldflags.
|
|
|
|
Consumed by the tailscale-operator app on indri's minikube (arm64); the
|
|
ringtail app uses the -nix tag from default.nix instead.
|
|
"""
|
|
|
|
import dagger
|
|
|
|
from blumeops.containers import (
|
|
alpine_runtime,
|
|
clone_from_forge,
|
|
go_build,
|
|
oci_labels,
|
|
)
|
|
|
|
VERSION = "v1.94.2"
|
|
|
|
|
|
async def build(src: dagger.Directory) -> dagger.Container:
|
|
source = clone_from_forge("tailscale", VERSION)
|
|
semver = VERSION.removeprefix("v")
|
|
|
|
builder = go_build(
|
|
source,
|
|
"/out/operator",
|
|
cmd_path="./cmd/k8s-operator",
|
|
tags="ts_kube,ts_package_container",
|
|
ldflags=(
|
|
"-w -s"
|
|
f" -X tailscale.com/version.longStamp={semver}"
|
|
f" -X tailscale.com/version.shortStamp={semver}"
|
|
),
|
|
)
|
|
|
|
# Upstream runs the operator as root on a minimal base; only CA certs
|
|
# are needed at runtime (operator talks to the k8s API and Tailscale
|
|
# control plane over HTTPS).
|
|
runtime = alpine_runtime(extra_apk=["ca-certificates"], create_user=False)
|
|
runtime = oci_labels(
|
|
runtime,
|
|
title="Tailscale Kubernetes Operator",
|
|
description="Tailscale operator for Kubernetes Ingress/egress proxies",
|
|
version=VERSION,
|
|
)
|
|
return runtime.with_file(
|
|
"/usr/local/bin/operator",
|
|
builder.file("/out/operator"),
|
|
permissions=0o555,
|
|
).with_entrypoint(["/usr/local/bin/operator"])
|